Support Device Bound Session Credentials (DBSC)

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

We have been trying to support device bound credentials for ages, but there has never been a standard that both Google and Microsoft agreed on, until now.

### Describe the solution you'd like

Last month Google [announced](
https://developer.chrome.com/blog/dbsc-windows-announcement) a joint standard with Microsoft that binds cookies for TPM.

This will take work. The [approach](https://developer.chrome.com/docs/web-platform/device-bound-session-credentials) uses short lived auth cookies, which require an implementation of session, and some new endpoints for cookie refresh.

It is additive, it can stop on top of the existing authentication cookie middleware, but the need for session is something we've typically avoided.

[The spec](https://w3c.github.io/webappsec-dbsc/) is still a draft, but given [the cooperation with Microsoft](https://security.googleblog.com/2026/04/protecting-cookies-with-device-bound.html), Okta et al, it's going to rapidly be a defacto standard before it makes it out of RFC.

### Additional context

_No response_